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The  Honorable  John  H.  Dalton 
The  Secretary  of  the  Navy 

Dear  Mr.  Secretary: 

This  report  presents  the  results  of  our  review  of  the  Navy’s  program  for 
addressing  its  Year  2000  computer  systems  problem.  The  problem  results 
from  the  inability  of  computer  systems  at  the  year  2000  to  interpret  the 
century  correctly  from  a  recorded  or  calculated  date  having  only  two 
digits  to  indicate  the  year.  Time  is  running  out  to  correct  Navy  systems 
that  could  malfunction  or  produce  incorrect  information  when  the  year 
2000  is  encountered  during  automated  data  processing.  The  impact  of 
these  failures  could  be  widespread,  costly,  and  potentially  debilitating  to 
important  Navy  operations  worldwide. 

We  performed  this  work  as  part  of  our  review  of  the  Department  of 
Defense’s  (dod)  Year  2000  computer  systems  efforts  for  the  Chairman, 
Senate  Committee  on  Governmental  Affairs;  the  Chairman  and  Ranking 
Minority  Member  of  the  Subcommittee  on  Government  Management, 
Information  and  Technology,  House  Committee  on  Government  Reform 
and  Oversight;  and  the  Honorable  Thomas  M.  Davis,  III,  House  of 
Representatives.  During  the  review,  we  assessed  (1)  the  status  of  the 
Navy’s  efforts  to  oversee  its  Year  2000  program  and  (2)  the 
appropriateness  of  the  Navy’s  strategy  and  actions  for  ensuring  that  the 
problem  will  be  successfully  addressed.  This  letter  summarizes  our 
concerns  and  provides  recommendations  for  addressing  them. 


Results  in  Brief 


The  Navy  relies  on  computer  systems  for  some  aspect  of  virtually  every 
operation,  including  strategic  and  tactical  operations;  sophisticated 
weaponry;  intelligence,  surveillance,  and  security  efforts;  strategic  sealift 
and  fleet  mobilization  and  readiness;  and  routine  business  functions  such 
as  financial,  personnel,  logistics,  and  contract  management.  Failure  to 
address  the  Year  2000  problem  in  time  could  severely  degrade  or  disrupt 
the  Navy’s  day-to-day  and,  more  importantly,  mission-critical  operations. 

The  Navy  has  taken  many  positive  actions  to  increase  awareness,  promote 
sharing  of  information,  and  encourage  its  components  to  make  Year  2000 
remediation  efforts  a  high  priority.  However,  it  is  behind  schedule  in 
remediating  systems.  For  example,  the  Navy  did  not  finish  assessing  its 


Page  1 


GAO/AIMD-98-1 50  Navy  Year  2000  Challenges 


Objectives,  Scope, 
and  Methodology 


mission-critical  systems  until  December  1997  even  though  it  anticipated 
that  this  would  be  done  in  June  1997.  In  addition,  it  is  still  in  the  initial 
stages  of  assessing  whether  Year  2000  fixes  are  required  for  computer 
hardware,  communications  equipment,  security  and  building  systems,  and 
other  infrastructure  equipment. 

Furthermore,  the  Navy  lacks  key  management  and  oversight  controls  to 
enforce  good  management  practices,  direct  resources,  and  establish  a 
complete  picture  of  its  progress  in  remediating  systems.  For  example,  the 
Navy: 

•  currently  lacks  a  comprehensive  departmentwide  inventory  of  systems 
requiring  remediation; 

♦  has  not  been  tracking  component  progress  in  developing  written 
agreements  with  their  interface  partners; 

♦  has  not  developed  a  test  strategy  for  the  department;  and 

•  is  not  developing  contingency  plans  that  focus  on  ensuring  the  continuity 
of  all  of  its  critical  military  operations  and  business  processes. 

As  a  result,  the  Navy  lacks  complete  and  reliable  information  on  its 
systems,  and  on  the  status  and  cost  of  its  remediation  efforts.  It  has  also 
increased  the  risk  that  (1)  Year  2000  errors  will  be  propagated  from  one 
organization’s  systems  to  another’s,  (2)  all  systems,  interfaces,  and 
equipment  important  to  Navy  operations  will  not  be  thoroughly  and 
carefully  tested,  and  (3)  the  department  will  not  be  prepared  if  systems  are 
not  corrected  or  replaced  by  the  Year  2000  deadline. 


Our  objectives  were  to  assess  (1)  the  status  of  Navy’s  effort  to  identify  and 
correct  its  Year  2000  problem  and  (2)  the  appropriateness  of  the  Navy’s 
strategy  and  actions  for  remediating  Year  2000  problems.  In  conducting 
our  review,  we  used  our  Year  2000  Assessment  Guide1  to  assess  the  Navy’s 
Year  2000  efforts.  This  guide  addresses  common  issues  affecting  most 
federal  agencies  and  presents  a  structured  approach  and  provides  a 
checklist  to  aid  in  planning,  managing,  and  evaluating  Year  2000  programs. 
The  guidance,  which  is  consistent  with  Defense’s  Year  2000  Management 
Plan2  and  the  Navy’s  own  Year  2000  management  approach,  describes  five 
phases — supported  by  program  and  project  management  activities — with 


^ear  2000  Computing  Crisis:  An  Assessment  Guide  (G AO/AIMD-1 0. 1.14,  September  1997);  first  issued 
as  an  exposure  draft  in  February  1997. 

2Version  2,  January  1998. 
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each  phase  representing  a  major  Year  2000  program  activity  or  segment. 
The  phases  and  a  description  of  each  follows. 

Awareness  -  Define  the  Year  2000  problem  and  gain  executive-level 
support  and  sponsorship.  Establish  a  Year  2000  program  team  and  develop 
an  overall  strategy.  Ensure  that  everyone  in  the  organization  is  fully  aware 
of  the  issue. 

Assessment  -  Assess  the  Year  2000  impact  on  the  enterprise.  Identify  core 
business  areas  and  processes,  inventory  and  analyze  systems  supporting 
the  core  business  areas,  and  prioritize  their  conversion  or  replacement. 
Develop  contingency  plans  to  handle  data  exchange  issues,  lack  of  data, 
and  bad  data.  Identify  and  secure  the  necessaiy  resources. 

Renovation  -  Convert,  replace,  or  eliminate  selected  platforms, 
applications,  databases,  and  utilities.  Modify  interfaces. 

Validation  -  Test,  verify,  and  validate  converted  or  replaced  platforms, 
applications,  databases,  and  utilities.  Test  the  performance,  functionality, 
and  integration  of  converted  or  replaced  platforms,  applications, 
databases,  utilities,  and  interfaces  in  an  environment  that  faithfully 
represents  the  operational  environment. 

Implementation  -  Implement  converted  or  replaced  platforms, 
applications,  databases,  utilities,  and  interfaces.  Implement  data  exchange 
contingency  plans,  if  necessary. 

During  our  review,  we  concentrated  on  the  Navy’s  efforts  to  oversee  its 
Year  2000  program  during  the  awareness  and  assessment  phases — the  first 
two  phases  of  its  overall  five-phased  approach.  We  focused  our  review  on 
Year  2000  work  being  carried  out  by  (1)  dod’s  Office  of  the  Assistant 
Secretary  of  Defense  for  Command,  Control,  Communications  and 
Intelligence  (asd/C3i),  which  is  responsible  for  promulgating  dod  guidance 
on  Year  2000  matters  and  providing  assistance  to  Defense  components, 

(2)  Navy  Headquarters,  including  the  Offices  of  the  Chief  Information 
Officer  (cio),  who  is  responsible  for  overall  coordination  and  management 
and  for  issuing  Navy  Year  2000  policy  and  guidance,  and  (3)  the  Navy’s 
two  largest  systems  commands,  the  Naval  Air  Systems  Command  (navair) 
and  the  Naval  Sea  Systems  Command  (navsea),  which  are  the  central 
activities  responsible  for  developing,  acquiring,  and  supporting 
aeronautical  systems  and  ships  and  related  weapons  and  combat  systems. 

Specifically,  we  met  with  the  Acting  Assistant  Secretary  of  Defense  for 
Command,  Control,  and  Communications  and  Intelligence,  the  Principal 
Director  for  Information  Management,  the  Director  for  Information 
Technology,  and  other  senior  staff  responsible  for  Year  2000  issues.  We 
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reviewed  Defense’s  Year  2000  guidance  and  other  documentation  on  Year 
2000  funding,  reporting,  and  date  format  requirements.  We  met  with  the 
Acting  Deputy  Chief  Information  Officer,  the  Team  Leader  and 
Coordinator  from  the  Year  2000  Coordination  Office,  and  the  navsea 
Coordinator  and  the  navair  Deputy  cio.  We  obtained  and  analyzed 
documents  issued  by  these  offices  that  describe  organizational  structure 
and  responsibilities  for  carrying  out  the  Navy  Year  2000  program.  We 
reviewed  the  Navy’s  Year  2000  Action  Plan3  to  assess  the  level  of  guidance, 
roles,  and  responsibilities,  and  target  milestone  dates  for  the  Year  2000 
effort. 

We  also  reviewed  other  pertinent  Year  2000  program  documentation  such 
as  Defense  and  Navy  guidance  and  management  directives,  working  group 
minutes,  status  reports,  and  cost  and  schedule  data.  Further,  we  reviewed 
available  inventory  information  on  the  Navy’s  mission-critical  systems 
contained  in  the  Defense  Integration  Support  Tools  (DrsT)  database,  which 
the  Navy  uses  to  help  manage  its  Year  2000  efforts.  In  doing  so,  we 
determined  (1)  the  number  of  systems  reported  to  be  owned  and  operated 
by  Navy  organizations  and  (2)  the  reported  status  of  Navy  systems  in  their 
Year  2000  efforts.  We  also  assessed  the  reliability  and  completeness  of  the 
Navy’s  Year  2000  information. 

We  relied  on  work  previously  conducted  at  the  Naval  Supply  Systems 
Command  (navsup),  which  is  the  Navy’s  primary  supply  manager.  In  our 
report4  on  navsup’s  Year  2000  efforts,  we  found  that  navsup  had  made 
considerable  progress  in  meeting  its  Year  2000  challenges  as  a  result  of 
implementing  a  centralized  management  and  control  approach. 

We  performed  our  work  primarily  at  the  Navy’s  Year  2000  Coordination 
Office  and  the  Office  of  the  Assistant  Secretary  of  Defense  for  Command, 
Control,  Communications  and  Intelligence  in  Arlington,  Virginia.  We 
conducted  our  work  from  August  1997  through  April  1998  in  accordance 
with  generally  accepted  government  auditing  standards.  We  requested 
comments  on  a  draft  of  this  report  from  the  Secretary  of  the  Navy. 
Comments  from  the  department  are  discussed  in  the  “Agency  Comments 
and  Our  Evaluation”  section  and  are  reprinted  in  appendix  II. 


^Specifically,  we  reviewed  the  Navy’s  draft  plan  dated  November  1997  and  subsequent  revisions  issued 
in  January  and  March  1998. 

^Defense  Computers:  Technical  Support  Is  Key  to  Naval  Supply  Year  2000  Success  (*  ‘  V4  \  !M  I » *'• 
October  21, 1997). 
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Background 


Most  of  the  Navy’s  automated  information  systems  and  weapons  systems 
are  vulnerable  to  the  Year  2000  problem,  which  is  rooted  in  the  way  dates 
are  recorded  and  computed  in  automated  information  systems.  For  the 
past  several  decades,  systems  have  typically  used  two  digits  to  represent 
the  year,  such  as  “97”  representing  1997,  in  order  to  conserve  electronic 
data  storage  and  reduce  operating  costs.  With  this  two-digit  format, 
however,  the  Year  2000  is  indistinguishable  from  1900,  or  2001  from  1901, 
etc.  As  a  result  of  this  ambiguity,  computerized  systems  and/or  application 
software  that  use  dates  to  perform  calculations,  comparisons,  or  sorting 
may  generate  incorrect  results  when  working  with  years  after  1999.  In 
addition,  any  electronic  device  that  contains  a  microprocessor  or  is 
dependent  on  a  timing  sequence  may  be  also  vulnerable  to  Year  2000 
problems.  This  includes  computer  hardware,  telecommunications 
equipment,  building  and  base  security  systems,  street  lights  at  military 
installations,  elevators,  and  medical  equipment. 

Should  Navy  computer  systems  fail,  Navy  operations  at  all  levels  could  be 
impacted  by  the  incorrect  processing  of  data  as  well  as  corrupted 
databases  or  even  massive  system  failures.  In  turn,  this  could  result  in 
such  problems  as  delays  in  supply  shipments,  faulty  inventory  forecasts, 
unreliable  budget  estimates,  and  erroneous  personnel-related  information. 
Moreover,  the  problem  could  adversely  impact  critical  maritime 
operations  such  as  combat,  communications,  command  and  control, 
intelligence,  surveillance,  reconnaissance,  strategic  sealift,  and  fleet 
mobilization  and  readiness. 

Like  the  other  military  services,  the  Navy  has  adopted  dod’s  Year  2000 
management  strategy,  which  charges  components  (that  is,  program 
managers  and  system  owners)  with  responsibility  for  making  sure  that  all 
of  their  systems  correctly  process  dates  and  gives  them  the  flexibility  to 
implement  solutions  as  they  deem  appropriate.  In  December  1995,  the 
Navy  designated  the  Navy  Information  Systems  Management  Center  with 
responsibility  for  (1)  coordinating  Year  2000  efforts  being  carried  out  by 
its  9  operating  forces,  including  the  U.S.  Marine  Corps,  and  its  17  shore 
establishments  which  include  5  major  systems  commands,  (2)  facilitating 
the  sharing  of  Year  2000  information  and  best  practices  departmentwide, 
and  (3)  monitoring  the  Navy’s  Year  2000  progress.  In  August  1997,  the 
Navy  transferred  this  responsibility  to  its  newly  established  Office  of  the 
Department  of  the  Navy  Chief  Information  Officer.  Appendix  I  illustrates 
the  Navy’s  organizational  structure  and  describes  the  complexity  involved 
in  carrying  out  Year  2000  efforts  at  the  component  level. 
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To  comply  with  dod’s  current  Year  2000  funding  mandate,  the  Navy  is  not 
providing  program  managers  and  system  owners  additional  funds  to 
manage  and  fix  the  Year  2000  problem.  Rather,  program  managers  and 
system  owners  have  been  directed  to  use  previously  budgeted  funds  (that 
is,  primarily  operational  and  maintenance  (o&m)  funds)  or  reprogram  other 
programmatic  funds  to  fix  Year  2000  problems.  As  of  February  1998,  the 
Navy  estimated  that  it  will  cost  about  $42 1  million  to  successfully 
complete  its  Year  2000  program,  but  as  discussed  later,  this  estimate  is  not 
reliable. 


The  Navy’s  Year  2000 
Efforts  to  Date 


To  increase  awareness  of  Year  2000  and  to  foster  coordination  among  its 
components,  the  Navy  has  taken  the  following  actions. 

In  November  1995,  it  formally  began  the  awareness  phase  of  its  Year  2000 
program. 

In  April  1996,  it  established  a  Navy  Year  2000  homepage  that  serves  as  a 
clearinghouse  for  Year  2000  information. 

Since  October  1996,  it  has  participated  in  a  number  of  Year  2000  interface 
assessment  workshops  sponsored  by  Defense.  These  workshops  are 
designed  to  acquaint  managers  with  the  nature  and  extent  of  interface 
problems  pertaining  to  21  functional  areas,  such  as  finance,  intelligence, 
logistics,  communications,  and  weapons  systems. 

From  March  1997  through  May  1998,  it  has  conducted  quarterly  reviews  to 
keep  abreast  of  Year  2000  problems.  These  reviews  are  attended  by 
representatives  from  the  Secretary  of  the  Navy,  the  cio  office,  and  the 
major  Navy  and  Marine  Corps  commands  and  activities.  Since  May  1998, 
the  Navy  cio  office  has  been  holding  weekly  briefings  with  the  commands. 
In  April  1997,  it  adopted  and  implemented  dod’s  compliance  checklist  to 
assist  system  managers  in  ensuring  that  their  systems  are  compliant  for 
the  Year  2000.  The  checklist  focuses  on  (1)  identification  of  systems  and 
interfaces,  (2)  assessment  of  date  usage  by  the  systems,  and 
(3)  compliance  testing,  among  other  subjects. 

In  August  1997,  it  identified  Year  2000  as  its  highest  priority  behind 
life-threatening  or  mission  failure  repairs  and  instructed  components  to 
put  a  higher  priority  on  funding  remediation  efforts  than  on  other 
information  technology  initiatives. 

In  December  1997,  it  tasked  the  Navy  Inspector  General  to  assess  Year 
2000  readiness  at  its  commands.  The  ig  plans  to  report  on  its  assessment 
of  12  commands  in  April.  At  the  time  of  our  review,  the  ig  had  not  issued 
any  reports.  In  February  1998,  the  Navy  requested  the  Naval  Audit  Service 
to  review  Year  2000  readiness  at  the  commands  not  visited  by  the  ig. 
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•  In  January  1998,  it  formally  issued  its  Year  2000  Action  Plan.  The 
March  1998  revision  of  this  plan  sets  milestones  for  the  completion  of 
major  Year  2000  activities  and  provides  exit  criteria  for  each  phase. 

In  February  1998,  the  Navy  reported  to  the  Office  of  Management  and 
Budget  that  it  had  812  mission-critical 5  and  1,575  nonmission-critical 
automated  information  and  embedded  systems.6  According  to  the  Navy, 
781  mission-critical  systems  need  to  be  repaired;  about  a  quarter  of  these 
were  reported  to  be  in  the  renovation  phase  and  over  half  in  the  validation 
phase.  In  addition,  the  Navy  reported  that  1,422  nonmission-critical 
systems  need  to  be  repaired;  about  a  third  of  these  were  reported  to  be  in 
renovation  and  half  in  validation.  Specific  reported  totals  for 
February  1998  are  shown  in  table  1.  As  discussed  later  in  this  report,  we 
found  the  Navy’s  status  information  to  be  unreliable. 


"For  Year  2000  purposes,  the  Navy  defines  a  mission-critical  system  as  “a  system  that  when  its 
capabilities  are  degraded,  the  organization  will  realize  a  resulting  loss  of  a  core  capability.” 

£5These  figures  reflect  only  those  systems  entered  into  the  DIST  database. 
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Table  1:  Reported  Status  of  the  Navy’s 
Year  2000  Efforts 


Mission-critical  systems 

Nonmission-criticaf 

systems 

Status 

Number 

Percent3 

Number  Percent3 

Total  systems 

812 

1,575 

Compliant 

0 

0 

0 

0 

To  be  replaced  before  2000 

19 

2.3 

26 

1.7 

To  be  retired  before  2000 

12 

1.5 

127 

8.1 

To  be  repaired 

781 

96.2 

1,422 

90.3 

Reported  status  of  systems  to  be 
repaired 

Total  systems 

781 

1,422 

In  awareness  phase 

0 

0 

0 

0 

In  assessment  phase 

0 

0 

33 

2.3 

In  renovation  phase 

191 

24.5 

459 

32.3 

In  validation  phase 

441 

56.5 

712 

50.1 

In  implementation  phase 

14 

1.8 

20 

1.4 

Corrected13 

135 

17.3 

198 

13.9 

Percentages  do  not  total  100  percent  due  to  rounding. 

b\n  late  1997,  the  Office  of  the  Secretary  of  Defense  established  this  reporting  category  to 
indicate  those  systems  that  have  completed  all  five  Year  2000  phases.  NAVAIR,  for  example, 
plans  to  require  the  system  sponsor  to  certify  its  systems  as  Year  2000  compliant  before  it  can 
report  it  as  "corrected." 

Source:  Navy  information  reported  to  the  Office  of  Management  and  Budget.  We  did  not 
independently  verify  this  information. 


In  its  February  1998  report,  the  Navy  provided  the  following  information 
on  personal  computers  and  communications  and  facility  equipment. 
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Table  2:  Information  Reported  by  the  Navy  on  Other  Equipment 


Personal 

computers/servers 

Communication  devices 

(including 

telecommunications 

equipment) 

Facility  devices  (includes 
such  items  as  elevators, 
security  systems,  and 
medical  equipment) 


Total 

inventory 

313,781 


13,105 


329,999 


Number 

compliant 

111,114 


116,467 


Percent 

compliant 


Number  not 
compliant 

164,241 


166,925 


Percent  not 
compliant 


Number 

Status 

unknown 

38,426 


Source:  Navy  information  reported  by  components.  Only  compliant  systems  were  reported  to  the 
Office  of  Management  and  Budget.  We  did  not  independently  verify  this  information. 


Navy  Progress  in  Early 
Year  2000  Phases  Has  Been 
Slow 


The  Navy  is  behind  schedule  in  completing  the  early  phases  of  its  Year 
2000  program.  For  example,  although  Defense  required  that  all  systems  be 
assessed  by  June  1997,  the  Navy  reported  that  it  did  not  finish  assessing  its 
mission-critical  systems  until  December  1997,  and,  as  of  February  1998, 
reported  it  was  still  assessing  about  2  percent  of  its  nonmission-critical 
systems .  In  addition,  it  did  not  issue  an  approved  Year  2000  program 
management  plan  until  January  1998.  Our  guide  recommends  that  this  be 
done  early  in  the  assessment  phase.  Further,  it  is  still  assessing  whether 
corrective  actions  are  needed  for  other  equipment  such  as  computer 
hardware,  communications  equipment,  and  security  systems.  In  April  1998, 
the  Navy  issued  a  draft  assessment  guide  to  evaluate  these  assets. 


Technology  experts  like  the  Mitre  Corporation  and  the  Gartner  Group 
estimate  that  organizations  should  spend  less  than  30  percent  of  their 
effort  in  the  first  two  phases  and  reserve  70  percent  for  the  renovation, 
validation,  and  implementation  phases  of  the  Year  2000  program.  Because 
the  Navy  has  spent  about  60  percent  of  the  time  available  completing  the 
first  two  phases,  it  will  be  difficult  to  complete  the  more  complex  and 
time-consuming  tasks  of  renovating,  testing,  and  implementing  its  systems 
in  the  time  remaining. 


Navy  officials  acknowledge  that  the  assessment  phase  is  taking  longer 
than  expected.  They  attribute  this  delay  to  difficulties  associated  with 
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developing  a  complete  systems  inventory  and  the  lack  of  skilled  field 
people  to  perform  Year  2000  tasks.  Before  its  Year  2000  effort,  the  Navy 
did  not  have  a  comprehensive  servicewide  system  inventory  nor  did  many 
of  its  components.  Therefore,  it  could  not  readily  determine  the  magnitude 
of  the  Year  2000  problem  servicewide  or  the  cost  to  fix  it. 

Even  though  Navy  cio  officials  acknowledged  that  the  department  is 
behind  schedule,  the  Navy  has  recently  moved  up  its  target  completion 
dates  for  its  mission-critical  systems  for  the  remaining  three  phases. 


Table  3:  Navy’s  Accelerated  Year  2000 
Target  Completion  Dates  for 
Mission-Critical  Systems 


Phase 

November  1997 
draft  action  plan 

March  1998 
action  plan 

Awareness 

12/1/96 

12/1/96 

Assessment 

6/30/97 

6/30/97 

Renovation 

8/1/98 

6/30/98a 

Validation 

12/30/98 

10/30/98 

Implementation 

5/1/99 

12/31/98* 

aOMB’s  governmentwide  target  completion  date  for  renovation  is  September  1998;  the  target 
completion  date  for  implementation  is  March  1999. 


Under  the  accelerated  schedule,  the  Navy  plans  to  complete  the 
renovation  phase  for  mission-critical  systems  about  1  month  sooner  than  it 
originally  anticipated  and  the  testing  phase  2  months  earlier  than  originally 
anticipated.  It  also  plans  to  complete  the  implementation  phase  4  months 
earlier  than  anticipated  and  3  months  before  omb’s  recommended 
completion  date.  Based  on  the  latest  reported  component  data,  the  Navy 
estimates  that  only  seven  mission-critical  systems  will  not  meet  its  new 
dates. 

As  the  following  sections  of  this  report  discuss,  the  Navy  is  at  risk  of  not 
meeting  its  new  schedule  because  it  has  not  yet  established  key 
management  and  oversight  controls  needed  to  successfully  complete  the 
next  phases.  Specifically: 

•  At  the  time  of  our  review,  Navy  headquarters  as  well  as  some  components 
did  not  have  strong  program  offices  to  guide  them  through  the  more 
complex  and  difficult  phases  of  remediation. 

•  The  Navy  still  does  not  have  complete  and  accurate  information  on 
systems,  the  status  of  remediation  efforts,  and  costs. 


Page  10 


GAO/AIMD-98- 150  Navy  Year  2000  Challenges 


B-279872 


•  The  Navy  has  not  yet  identified  all  system  interfaces  nor  ensured  that 
interface  partners  are  effectively  working  together  to  correct  interfaces. 

•  The  Navy  has  not  developed  an  overall  strategy  for  testing  its  systems. 

In  addition,  Navy  operations  are  at  risk  because  the  Navy  has  not 
developed  contingency  plans  to  ensure  that  mission  functions  can  be 
performed  if  mission-critical  systems  are  not  corrected  in  time. 


The  Navy  Has  Not 
Been  Effectively 
Overseeing  and 
Managing  Year  2000 
Remediation  Efforts 


In  view  of  the  magnitude  of  the  Year  2000  problem,  our  Assessment  Guide 
recommends  that  agencies  plan  and  manage  their  Year  2000  programs  as  a 
single  large  information  system  development  effort  and  promulgate  and 
enforce  good  management  practices  at  the  program  and  project  levels.  The 
guide  also  recommends  that  agencies  appoint  a  Year  2000  program 
manager  and  establish  an  agency-level  Year  2000  program  office. 

The  Navy  took  a  decentralized  approach  to  the  Year  2000  effort  but  it  did 
not  initially  establish  a  strong  Year  2000  program  office  to  manage  it 
effectively.  For  example,  during  our  review,  the  Navy  had  assigned  only 
five  full-time  personnel  in  the  office  of  the  cio  to  oversee  and  monitor  the 
Year  2000  progress  of  more  than  2,000  systems  and  300,000  personal 
computers  and  servers  owned  by  five  major  systems  commands,  17  shore 
establishments,  and  9  operating  forces,  including  the  U.S.  Marine  Corps. 

By  contrast,  the  Air  Force  assigned  27  staff  to  the  Year  2000  problem — 3  to 
oversee  and  implement  program  and  policy  changes  across  the  service  and 
24  to  execute  the  program.7  According  to  Navy  cio  officials,  the  office  had 
not  managed  Year  2000  remediation  efforts  effectively,  and  most  of  the 
staffs  time  had  been  spent  reporting  the  status  of  component  efforts  to 
top  managers  in  the  Navy,  dod,  and  external  entities,  such  as  the  cio 
Council  and  omb.  For  example,  at  the  time  of  our  review,  the  staff  was  not 
validating  information  being  reported  by  Navy  components  for 
completeness  and  accuracy;  assessing  component  efforts  to  prioritize 
systems;  or  tracking  component  progress  in  completing  important  Year 
2000-related  activities,  such  as  contingency  planning  and  testing. 

Some  of  the  Navy’s  components  also  did  not  support  their  own  efforts 
with  a  strong  program  office.  For  example,  at  the  time  of  our  review, 
navsea  did  not  have  any  dedicated  full-time  Year  2000  staff  at  the 
command  level,  even  though  it  is  responsible  for  managing  more  than  350 


7The  three  staff  assigned  to  oversee  the  program  work  at  the  Air  Force  Communications  and 
Information  Center  (AFCIC),  which  reports  to  the  Office  of  the  Chief  Information  Officer.  The  24 
personnel  assigned  to  execute  the  program  work  at  the  Air  Force  Year  2000  Program  Office  at  Scott 
Air  Force  Base,  Illinois,  which  reports  to  AFCIC. 
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systems  involving  138  major  acquisition  programs  and  345  ships — all  of 
which  are  susceptible  to  Year  2000  problems,  navair,  which  is  responsible 
for  about  870  systems  involving  over  200  aeronautical-related  programs 
and  over  4,600  aircraft,  assigned  only  three  full-time  staff  to  work  on  the 
command’s  Year  2000  problem. 

The  Navy  has  recently  responded  to  this  problem  by  assigning  three 
additional  staff  to  the  cio  Office  to  help  coordinate  Year  2000  activities  and 
by  establishing  a  new  Year  2000  Project  Office  for  Navy  Operations, 
comprised  of  15  staff.  As  shown  in  appendix  I,  the  Chief  of  Naval 
Operations  is  responsible  for  operating  forces  across  all  Navy  commands 
and  shore  activities  as  well  as  key  functions,  such  as  intelligence,  logistics, 
and  training.  The  office,  which  will  begin  operating  in  June  1998,  will  be 
responsible  for  coordinating  the  testing  efforts  of  navair,  navsea,  the  Space 
and  Warfare  Systems  Command,  and  fleet  commands.  However,  there  are 
no  plans  to  have  either  the  cio  Office  or  the  new  project  office  validate 
data  reported  by  the  components  or  assess  component  progress  in 
prioritizing  systems,  identifying  and  correcting  interfaces,  and  developing 
contingency  plans. 


The  Navy  Does  Not 
Yet  Have  Complete 
and  Accurate  Year 
2000  Information 


According  to  our  Assessment  Guide,  a  key  part  of  the  assessment  phase  is 
to  identify  business  areas  that  are  critical  to  the  enterprise  and,  for  each 
area,  critical  business  processes  and  supporting  information  systems.  In 
constructing  the  inventory  of  information  systems,  it  is  important  to  assess 
the  potential  impact  on  business  processes  if  systems  are  not  fixed  on 
time,  to  estimate  the  cost  of  remediation,  and  to  monitor  the  progress 
components  are  making  toward  correcting  their  systems.  This  provides  the 
necessary  foundation  for  Year  2000  program  planning.  The  Navy,  however, 
does  not  yet  have  a  complete  and  accurate  inventory  or  reliable  status  and 
cost  information.  As  a  result,  it  does  not  have  a  clear  picture  of  its  Year 
2000  remediation  efforts  and  it  cannot  reliably  prioritize  systems  for 
correction,  determine  what  resources  it  needs,  or  identify  problems  that 
require  greater  management  attention. 

Until  recently,  the  Navy’s  primary  source  of  Year  2000  system  inventory 
information  was  the  Defense-wide  database  of  automated  systems,  known 
as  the  Defense  Integration  Support  Tools  (dist)  database.8  The  Navy  was 
using  this  database  to  help  oversee  its  Year  2000  efforts  and  prepare  its 


8At  the  beginning  of  its  Year  2000  effort,  Defense  designated  DIST  as  the  primary  departmentwide  Year 
2000  tracking  tool.  Some  components,  such  as  the  Air  Force  and  the  Army,  also  built  their  own 
databases  and  used  them  in  managing  their  Year  2000  programs.  The  Navy  decided  to  rely  solely  on 
DIST  and  did  not  build  a  separate  database. 
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quarterly  status  reports  to  the  Department  of  Defense,  which,  in  turn, 
submits  the  information  to  the  Office  of  Management  and  Budget. 

In  February  1998,  due  to  concerns  that  extensive  and  detailed  information 
on  all  of  the  Department’s  mission-critical  systems  was  available  on  the 
Internet,  asd/C3i  removed  dist  from  the  Internet  and  classified  it  as 
“secret” — meaning  that  it  can  only  be  accessed  by  personnel  with  a  valid 
security  clearance,  job-related  “need-to-know,”  and  access  to  secure 
computer  and  communications  equipment.  As  a  result,  the  Navy  has  no 
readily  accessible  central  repository  of  system  information  to  help  oversee 
system  fixes  or  respond  to  ad  hoc  requests  for  Year  2000  information  from 
omb  or  Defense.  According  to  the  cio  office,  the  secret  classification  given 
dist  has  “gravely  hindered”  its  ability  to  manage  the  Year  2000  effort. 

The  Navy  plans  to  resolve  this  problem  by  creating  a  separate  unclassified 
Year  2000  database  and  making  it  available  by  June  1998.  As  the  Navy 
implements  this  new  database,  it  will  be  important  for  it  to  correct  the 
data  problems  we  identified  in  our  discussions  with  command  and 
headquarters  officials  as  well  as  in  our  review  of  selected  information 
from  dist  on  the  Navy’s  mission-critical  systems9  provided  to  us  by  the 
Defense  Information  Systems  Agency  (disa)  database  administrator.  These 
problems  include  the  following. 

•  Of  819  mission-critical  systems  in  the  database,  6  systems  failed  to  identify 
which  stage  of  remediation  they  were  in,  23  did  not  provide  the  name  of 
the  system  or  describe  its  function,  and  118  failed  to  show  an  expected 
compliance  date. 

•  In  providing  the  data,  disa  did  not  include  cost  information  because  the 
Office  of  the  Assistant  Secretary  of  Defense  for  Command,  Control, 
Communications  and  Intelligence  concluded  that  the  data  were  unreliable. 
For  example,  asd/031  noted  that  in  some  cost  estimates,  the  decimal  point 
was  misplaced,  overstating  some  estimates  by  millions  of  dollars. 

•  Our  discussions  with  headquarters  and  command  officials  further  revealed 
that  the  cost  estimate  was  incomplete.  For  example,  navsea  officials  told 
us  that  the  Navy  was  missing  cost  information  for  about  95  percent  of 
navsea’s  138  major  acquisition  programs,  navair  also  indicated  that  many 
of  its  system  managers  were  not  reporting  costs. 


flIn  conducting  our  review,  we  were  not  provided  access  to  the  database.  However,  in  response  to  a 
request  from  the  House  Committee  on  National  Security  that  we  report  on  the  Year  2000  status  of 
Defense’s  mission-critical  systems,  DISA  provided  us  with  information  from  the  database  on  the 
Navy’s  mission-critical  systems,  including  the  name  and  description  of  the  system,  status  of 
remediation,  planned  versus  actual  date  of  compliance,  and  status  of  contingency  plans.  Because  this 
information  was  generated  after  the  Navy  submitted  its  February  1998  report  to  OMB,  it  reflects  seven 
more  mission-critical  systems  than  the  Februaiy  status  report. 


Page  13 


GAO/AIMD-98-150  Navy  Year  2000  Challenges 


B-279872 


.  The  reliability  of  cost  information  is  also  questionable  because  some  Navy 
components  are  still  using  a  cost  formula  derived  from  the  Gartner  Group 
and  the  Mitre  Corporation,  which  recommends  multiplying  the  number  of 
lines  of  code  by  $1.10  for  automated  information  systems  and  by  $8  for 
weapons  systems.  Defense  recommended  that  components  use  this 
formula  early  in  their  Year  2000  efforts,  but  it  also  recommended  that  a 
more  detailed  cost  analysis  based  on  more  than  30  cost  factors  be 
conducted  as  components  progressed  through  the  assessment  phase  and 
learned  more  about  their  systems  and  the  resources  that  would  be 
required  to  fix  them.  The  difference  between  the  Gartner/Mitre  formula 
and  a  more  reliable  analysis  of  data  collected  during  the  assessment  phase 
can  be  significant.  For  example,  based  on  the  Gartner/Mitre  formula,  the 
Navy  estimated  that  it  would  cost  $4.3  million  to  correct  a  mission-critical 
ordnance  management  system.  Based  on  a  detailed  cost  analysis  of  data 
collected  during  its  assessment,  the  Navy  estimated  that  remediation  costs 
would  actually  be  about  $1.75  million — a  59  percent  decrease  over  the 
original  estimate. 

In  addition,  as  the  new  database  is  implemented,  it  will  be  important  for 
the  Navy  to  routinely  validate  the  information  submitted  by  its 
components.  While  it  was  using  dist,  the  Navy  did  not  validate  the  data. 
Consequently,  it  had  no  assurance  that  the  information  on  its  systems, 
remediation  progress,  and  cost  was  correct  and  complete. 


Navy  Management  of 
Interface  Conversions 
Has  Been  Ineffective 


Navy  systems  interface  with  each  other  as  well  as  with  systems  belonging 
to  contractors,  other  federal  agencies,  and  international  entities,  such  as 
the  North  Atlantic  Treaty  Organization  and  foreign  military  sales 
customers.  Therefore,  it  is  essential  that  Navy  components  ensure  that  all 
interfaces  are  Year  2000  compliant  and  that  noncompliant  interfacing 
partners  will  not  introduce  Year  2000-related  errors  into  compliant  Navy 
systems.  Our  Assessment  Guide  and  dod’s  Year  2000  Management  Plan 
recommend  that  agreements  with  interface  partners  be  initiated  during  the 
assessment  phase  to  determine  how  and  when  interface  conflicts  will  be 
resolved. 


The  Navy  has  not  managed  the  identification  and  correction  of  its 
interfaces  effectively.  First,  although  the  Navy  set  the  goal  of  completing 
renovation  of  its  interfaces  by  June  30, 1998,  many  components,  including 
the  nine  navaik  and  navsea  weapon  system  program  offices  we  contacted 
during  our  review,  were  still  in  the  process  of  identifying  interfaces  and 
assessing  whether  they  need  to  be  corrected.  Second,  as  of  February  1998, 
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the  Navy  reported  to  omb  that  it  had  fixed  only  5  of  the  1,051  interfaces 
already  identified.  For  the  rest,  it  had  not  yet  determined  whether  data 
bridges  would  be  required,10  negotiated  who  was  responsible  for  installing 
and  funding  the  bridges,  or  developed  agreements  documenting  the 
method  and  schedule  for  correcting  the  interfaces.  Third,  the  Navy  was 
not  using  dist  (before  it  was  classified)  or  any  other  information  tool  to 
track  component  progress  in  completing  these  activities. 

The  Navy  recently  asked  its  Inspector  General  and  the  Naval  Audit  Service 
to  review  the  completeness  of  memorandums  of  agreement  as  they 
conduct  their  Year  2000  assessments  at  the  commands.  However,  these 
reviews  will  be  performed  on  a  limited  basis — they  are  not  designed  to 
ensure  that  all  mission-critical  program  managers  and  system  owners  have 
identified  their  interfaces,  taken  appropriate  measures  to  fix  them,  and 
documented  these  agreements  with  their  interface  partners. 


The  Navy  Is  Not 
Prepared  for  the 
Testing  Phase 


The  validation  (testing)  phase  of  the  Year  2000  effort  is  expected  to  be  the 
most  expensive  and  time-consuming.  Experts  estimate  that  it  will  account 
for  40  to  60  percent  of  the  entire  effort.11  As  dod’s  Year  2000  Management 
Plan  notes,  organizations  “must  not  only  test  Year  2000  compliance  of 
individual  applications,  but  also  the  complex  interactions  between  scores 
of  converted  or  replaced  computer  platforms,  operating  systems,  utilities, 
databases,  and  interfaces.” 

To  mitigate  the  risks  associated  with  testing,  our  Assessment  Guide  calls 
on  agencies  to  develop  validation  strategies  and  test  plans.  Validation 
strategies  are  developed  at  an  organizationwide  level  to  ensure  that 
common  test  requirements  are  followed  by  all  locations.  Specifically,  they 
describe  the  test  organization’s  and  its  components’  roles  and 
responsibilities,  system/project  priorities,  a  master  schedule  of  high-level 
test  activities  for  each  system/project,  and  the  test  resources  to  be  used  in 
carrying  out  these  activities  (people,  tools,  facilities,  and  contractors).  The 
plan  should  be  sufficiently  detailed  to  allow  system/project-specific 
planning  to  occur  as  well  as  to  permit  program  office  tracking  of  high-level 
test  activity  progress.  For  example,  it  should  have  milestones,  including 
completion  dates,  for  application/system  acceptance  tests,  specify  project 
progress  metrics,  and  allocate  common  test  facilities  and  other  resources 


inBridging  involves  receiving  information  in  one  format,  modifying  it,  and  outputting  it  in  another 
format,  such  as  receiving  the  year  in  a  two-digit  format,  adding  century  information  through  the  use  of 
an  algorithm,  and  writing  the  output  with  a  four-digit  year. 

nAccording  to  Mitre  Corporation  and  Gartner  Group. 
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among  system  renovation  projects  competing  for  these  facilities  and 
resources.  Since  agencies  may  need  over  a  year  to  adequately  validate  and 
test  converted  or  replaced  systems  for  Year  2000  compliance,  our 
Assessment  Guide  recommends  that  this  planning  begin  in  the  assessment 
phase. 

The  Navy  lacks  an  overall  validation  strategy  that  specifies  the  common 
criteria  and  processes  components  should  use  in  testing  their  systems.  As 
such,  it  has  no  assurance  that  all  systems  and  interfaces  will  be  thoroughly 
and  consistently  tested.  For  example,  in  the  absence  of  a  validation 
strategy: 

•  There  is  no  guidance  on  who,  when,  and  how  tests  of  the  Navy’s  estimated 
10,000  local  area  networks  (lans)  should  be  conducted.  As  a  result,  the 
Navy  Computer  and  Telecommunications  Command,  which  manages  these 
networks,  is  relying  solely  on  its  vendors  to  ensure  that  Navy  lans  are  Year 
2000  compliant.  It  does  not  plan  to  perform  end-to-end  tests12  on 
shore-based  lans  or  ensure  that  vendor  tests  are  adequate.13  One  Navy 
command  has  found  that  relying  on  vendors  to  ensure  that  systems  are 
compliant  is  not  enough  to  mitigate  Year  2000  risks.  When  navsup  tested 
products  that  vendors  claimed  were  compliant,  it  found  that  many  were 
not. 

•  The  Navy  does  not  know  how  much  testing  capacity  is  needed  by  its 
components  and  how  much  is  available  even  though  it  has  acknowledged 
that  these  resources  will  be  in  demand.  As  our  Assessment  Guide  notes, 
agencies  may  have  to  acquire  additional  facilities  in  order  to  provide  an 
adequate  testing  environment.  The  longer  the  Navy  waits  to  begin 
assessing  the  need  for  these  facilities,  the  less  time  it  will  have  to  acquire 
additional  facilities  or  otherwise  ensure  that  all  mission-critical  systems 
can  be  tested  before  the  Year  2000  deadline. 

In  addition  to  lacking  a  departmentwide  validation  strategy,  we  found  that 
two  major  components — navair  and  navsea — had  not  developed  strategies 
nor  were  they  ensuring  that  the  organizations  reporting  to  them  did  so.  In 


12The  purpose  of  end-to-end  testing  is  to  verify  that  a  defined  set  of  interrelated  systems,  which 
collectively  support  an  organizational  core  business  area  or  function,  interoperate  as  intended  in  an 
environment  which  faithfully  represents  the  operational  (i.e.,  live  production)  environment.  These 
interrelated  systems  include  not  only  those  owned  and  managed  by  the  organization,  but  also  those 
external  systems  with  which  they  interface.  Generally,  end-to-end  testing  is  conducted  when  one  major 
system  in  the  end-to-end  chain  is  modified  or  replaced  and  attention  is  rightfully  focused  on  the 
changed  or  new  system.  In  the  case  of  Year  2000  testing,  however,  most  if  not  all  of  the  systems  in  the 
end-to-end  chain  will  have  been  modified  or  replaced.  As  a  result,  the  scope  and  complexity  of  the 
testing  is  dramatically  increased,  as  is  the  difficulty  of  isolating,  identifying,  and  correcting  problems. 

13The  Navy  estimates  that  shipboard  LAN  end-to-end  testing  will  begin  in  the  spring  of  1999. 
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fact,  navair  did  not  require  its  program  managers  and  system  owners  to 
develop  individual  Year  2000  test  plans. 


Business  Continuity 
and  Contingency 
Planning  Is 
Inadequate 


To  mitigate  the  risk  that  Year  2000-related  problems  will  disrupt 
operations,  our  recently  issued  guide  on  business  continuity  and 
contingency  planning14  recommends  that  agencies  perform  risk 
assessments  and  develop  realistic  contingency  plans  during  the 
assessment  phase  to  ensure  the  continuity  of  critical  operations  and 
business  processes.  Contingency  plans  are  important  because  they  identify 
the  manual  or  other  fallback  procedures  to  be  employed  should  systems 
miss  their  Year  2000  deadline  or  fail  unexpectedly  in  operation. 
Contingency  plans  also  define  the  specific  conditions  that  will  cause  their 
activation. 

The  Navy  is  not  developing  contingency  plans  that  focus  on  ensuring  the 
continuity  of  all  of  its  critical  military  operations  and  business  processes. 
Instead,  it  is  developing  plans  for  only  a  small  portion  of  its 
mission-critical  systems — specifically  those  systems  that  (I)  are  scheduled 
for  implementation  beyond  January  1, 1999,  (2)  do  not  complete 
renovation  by  June  30, 1998,  or  (3)  fail  integrated  platform  testing.  The 
Navy  reported  that,  under  these  criteria,  only  7  of  the  812  mission-critical 
systems  currently  require  a  contingency  plan.  Three  of  these  plans  have 
been  completed.  The  Navy  is  taking  this  approach  because  it  believes  that 
it  should  spend  its  resources  on  identifying  and  fixing  Year  2000  problems 
early  and  then  concentrate  its  energy  on  contingency  plans  for  systems  for 
which  renovation  is  going  to  be  delayed. 

Preparing  contingency  plans  on  this  basis  is  not  judicious.  First,  even  if  the 
Navy’s  mission-critical  systems  are  replaced  or  renovated  in  time,  there  is 
no  guarantee  that  they  will  operate  correctly.  Second,  the  risk  of  Year  2000 
failures  is  not  limited  to  the  Navy’s  internal  systems.  In  fact,  the  Navy 
depends  on  information  and  data  provided  by  other  Defense  and  federal 
agencies,  international  organizations,  and  private  contractors  whose 
systems  can  introduce  Year  2000  problems  into  Navy’s  systems.  It  also 
relies  on  services  provided  by  the  public  infrastructure,  which  are 
susceptible  to  Year  2000  problems  that  could  disrupt  operations 
— including  power,  water,  and  voice  and  data  telecommunications.  Until 
its  contingency  fanning  focuses  on  this  chain  of  critical  dependencies,  the 


HYear  2000  Computing  Crisis:  Business  Continuity  and  Contingency  Planning  (GAO/AIMD-1 0. 1.19, 
Exposure  Draft,  March  1998). 
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Navy  will  not  be  able  to  ensure  that  it  can  maintain  the  basic  functionality 
of  its  critical  operations  and  core  business  processes. 


Conclusions 


Navy  operations  may  be  severely  disrupted  if  the  Navy  does  not 
successfully  remediate  its  mission-critical  computer  systems  before  the 
Year  2000  deadline.  While  the  Navy  has  taken  a  number  of  actions  to 
address  this  issue,  many  critical  tasks  remain  to  be  done  in  a  relatively 
short  period.  At  this  point,  the  Navy  does  not  know  whether  it  has 
identified  all  systems  and  interfaces;  it  lacks  reliable  data  on  the  status  and 
cost  of  remediation  efforts;  and  it  does  not  know  if  it  has  the  capacity  to 
handle  the  demanding  task  of  testing  systems,  networks,  operating 
platforms,  and  databases.  Despite  the  fact  that  these  weaknesses  have 
greatly  increased  the  chances  that  it  will  not  correct  its  mission-critical 
systems  in  time,  the  Navy  is  not  adequately  prepared  to  respond  to 
unforeseen  problems  and  delays. 


Recommendations 


We  recommend  that  you  direct  the  Department  of  the  Navy  Chief 
Information  Officer  to  ensure  that  the  Navy  Year  2000  Coordination  Office 
is  provided  with  sufficient  staff  and  authority  to  implement  the  following 
recommendations. 

Establish  a  complete  and  accurate  inventory  of  its  information  systems. 
Ensure  that  the  data  problems  identified  in  this  report  are  corrected  and 
routinely  validate  the  information  submitted  by  components  to  the 
database. 

Ensure  that  components  have  identified  and  corrected  interfaces  and 
developed  written  memorandums  of  agreement  with  interface  partners. 
Develop  a  departmentwide  testing  strategy  that  describes  program 
manager  and  system  owner  roles  and  responsibilities,  system/project 
priorities,  a  master  schedule  of  high-level  test  activities  for  each 
system/project,  and  the  test  resources  to  be  used  in  carrying  out  these 
activities  (people,  tools,  facilities,  and  contractors).  Ensure  that  Navy 
components  develop  their  own  test  strategies  and  require  their  program 
managers  and  system  owners  to  develop  individual  test  plans. 

Ensure  that  Year  2000  contingency  planning  focuses  on  the  continuity  of 
all  of  the  Navy’s  critical  military  operations  and  business  processes  rather 
than  on  only  a  small  portion  of  mission-critical  systems. 
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Agency  Comments 
and  Our  Evaluation 


In  written  comments  on  a  draft  of  this  report,  the  Department  of  the  Navy 
Chief  Information  Officer  (cio)  concurred  with  all  of  our  recommendations 
to  improve  the  Navy’s  Year  2000  program.  In  response  to  our 
recommendations,  the  Navy  agreed  to  establish  a  complete  and  accurate 
inventory  of  its  information  systems,  ensure  that  components  have 
identified  and  corrected  interfaces  and  developed  memorandums  of 
agreement  with  interface  partners,  develop  a  departmentwide  test 
strategy,  and  ensure  that  contingency  planning  focuses  on  the  continuity 
of  critical  military  operations  and  business  processes.  The  Navy  also 
stated  that  it  has  increased  staff  in  its  Year  2000  Coordination  Office  to  10 
full-time  employees  to  help  cany  out  these  activities. 

In  addition,  the  Navy  noted  that  its  new  Year  2000  database,  which  is 
expected  to  be  on-line  in  June  1998,  will  include  additional  data  elements 
not  contained  in  dist,  such  as  actual  and  programmed  costs,  planned  and 
actual  dates  that  memorandums  of  agreements  are  signed  with  interface 
partners,  the  dates  that  test  plans  are  prepared,  and  the  status  of  testing 
activities.  As  part  of  the  validation  process,  the  cio  Office  plans  to  conduct 
weekly  reviews  of  the  data  for  completeness  and  accuracy.  The  Navy  also 
stated  that,  in  addition  to  requiring  that  contingency  plans  be  prepared  on 
the  continuity  of  business  operations  and  to  ensure  mission  capability  at 
the  user  level,  it  is  now  requiring  contingency  plans  to  be  prepared  for 
all — rather  than  a  select  few — mission-critical  systems  no  later  than 
December  1998. 


This  report  contains  recommendations  to  you.  The  head  of  a  federal 
agency  is  required  by  31  U.S.C.  720  to  submit  a  written  statement  on 
actions  taken  on  these  recommendations  to  the  Senate  Committee  on 
Governmental  Affairs  and  the  House  Committee  on  Government  Reform 
and  Oversight  not  later  than  60  days  after  the  date  of  this  report.  A  written 
statement  also  must  be  sent  to  the  House  and  Senate  Committees  on 
Appropriations  with  the  agency’s  first  request  for  appropriations  made 
more  than  60  days  after  the  date  of  this  report. 

We  are  providing  copies  of  this  report  to  the  Chairmen  and  Ranking 
Minority  Members  of  the  Senate  Committee  on  Governmental  Affairs,  the 
Subcommittee  on  Oversight  of  Government  Management,  Restructuring 
and  the  District  of  Columbia,  Senate  Committee  on  Governmental  Affairs, 
the  Subcommittee  on  Defense,  Senate  Committee  on  Appropriations,  the 
Senate  Committee  on  Armed  Services,  the  Subcommittee  on  Government 
Management,  Information  and  Technology,  House  Committee  on 
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Government  Reform  and  Oversight,  the  Subcommittee  on  National 
Security,  House  Committee  on  Appropriations,  and  the  House  Committee 
on  National  Security.  We  are  also  sending  copies  to  the  Honorable 
Thomas  M.  Davis,  III,  House  of  Representatives;  the  Deputy  Secretary  of 
Defense;  the  Acting  Assistant  Secretary  of  Defense  for  Command,  Control, 
Communications  and  Intelligence;  the  Navy  Chief  Information  Officer;  and 
the  Director  of  the  Office  of  Management  and  Budget.  If  you  have  any 
questions  on  matters  discussed  in  this  report,  please  call  me  at 
(202)  512-6240.  Major  contributors  to  this  report  are  listed  in  appendix  III. 

Sincerely  yours, 


Jack  L.  Brock,  Jr. 

Director,  Governmentwide  and  Defense  Information  Systems 
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o&m  operational  and  maintenance 

omb  Office  of  Management  and  Budget 
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Navy  Year  2000  Organizational  Structure 


As  figure  1.1  indicates,  the  size  and  complexity  of  the  Department  of  the 
Navy’s  organization  structure  poses  a  significant  management  challenge. 
Year  2000  management  and  oversight  efforts  will  have  to  be  coordinated 
among  17  major  Navy  shore  establishments  including  5  major  systems 
commands  and  9  operating  forces,  such  as  the  U.S.  Marine  Corps,  the 
Naval  Reserve  Forces,  the  Military  Sealift  Command,  and  the  Atlantic  and 
Pacific  Fleets. 

Figure  1.2  provides  an  example  of  just  one  command’s  field  structure.  To 
understand  the  complexity  involved  in  carrying  out  Year  2000  efforts  at  the 
command  level,  consider  the  following. 

•  The  Naval  Sea  Systems  Command’s  fiscal  year  1998  budget  accounts  for 
about  19  percent  (or  $15  billion)  of  the  Navy’s  total  budget. 

•  The  Naval  Sea  Systems  Command,  which  is  the  largest  of  five  Navy 
systems  commands,  employs  about  55,000  personnel. 

•  The  command  currently  manages  138  acquisition  category  programs 
assigned  to  six  program  executive  offices,  including  Carriers,  Littoral 
Warfare,  and  Auxiliary  Ships;  Mine  Warfare;  Surface  Combatants/AEGIS 
Program;  Submarines;  Theater  Air  Defense;  and  Undersea  Warfare. 

•  The  command  is  responsible  for  345  ships,  including  92  submarines  and  14 
aircraft  carriers,  assigned  to  24  home  ports  in  the  United  States  and 
overseas. 

•  The  command  manages  about  1,275  foreign  military  sales  cases.  Because 
the  command’s  systems  interface  with  the  systems  belonging  to  its  foreign 
military  sales  customers,  it  will  need  to  develop  interface  agreements  with 
its  customers. 

•  The  Naval  Sea  Systems  Command  alone  has  about  56  Year  2000 
points-of-contacts. 
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Figure  1.1 :  Department  of  the  Navy  Organization  Structure 
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Figure  1.2:  Example  of  the  Field  Structure  at  One  Navy  Command 
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DEPARTMENT  OF  THE  NAVY 

CHIEF  WFOAWATf OK 

■fnnO  NAVYFCKT^COO 
t*ASN<FATn*  ac.  jgWMtta 

m  -8  m 


Mr.  Gone  f.  Doriotx),  Am^rttCoiiopDMbr  Ococrh) 

Accounting  von?  tnftrnrt«uion  Mansgernem  Diviswn 
General  Awwunthig  Office 
Washington.  DC  20548 

Dear  Mi.  Dwtero: 

One  af  my  bigheat  priorities  to  the  Department  of  cte  Navy  b  enw?  no  rctotai* 
critical  systeio tortures  cooor  due  tn  Year  /Oft)  (Y2K.)  related prcfcforo*.  TJte  bopact  ot' 
the  KMiienalioo  ihrte  dtarigt  on  the  Departments  many  inhumation  technology  system* 
will  be  detciTmbitrd  largely  t>>  the  attention  we  devote  to  sobhig  the  Year  2(00  (Y 2K) 
proofing  problem.  To  address  tbl*  issue,  my  office  provided  gyMur.ce  wWcb  w&v?  a 
cstcm!  bred  owingewoot/  deceidreJisred  exocodon  policy.  I he  D^wtoant's  Y2K 
ptogrwscs  arc  reported  to  mo  weekly  b>  ayrtem  o  wikis  thft-uig  tegohnly  scheduled 
brislings. 

f  aJDoimve  cKJccd  Novel  Audit  Set  vict?  nod  Herel  ftispfc&tor  General  to  conduct 
reviews  of  Y2K  state  ufid  report  their  firuiluy^  tu  me.  These  reviews  exstfftino  EcWou  11 
Commands  for  proper  allocation  of  resources,  for  pmgreos  against  DON-  and  DoD 
DiwuUiO(5miio3t#7>:ex,  for  cou:mg*ov-y  pbm>,  foe  Te*p«>rtdbtt:iy  cs.vjgom^t»  Hn<t 
KfcDt»f«:act«iH  of  5>stm  ititatoce*.  for  3 cqatred  totnootanda  of  Aereooeot.  and  tor  use  of 
rhf  DepHrnnerit:  of  the  Nm-  y  Y2K  Datable. 

Yooc  findings  jouI  recomrnouktiocs  have  fiestbctyfuJ  :o  kJcoo  tying  occessury 
chanoa;  »n  our  approach  to  giving  this  wry  hnporfcmi  etisilenge.  During  tny*  short 
tenure  as  DON  CIO  we  have  accomplished  two  of  the  OAO  report  recommcitdatiinii*  end 
wc  tolly  committed  to  completing  the  remaining  two  reoomm^ndat iiw,  Oltwo  Jot  me 
toow  if  yoo  v/ooW  lite  to  meet  to  discos*  this  issue  t'cnboc.  My  point  of  enmoct  is 
CAP!  Ciitfurd  Swrfrao.  (70.1) 


6r.  Ann  Miller 


Aitochmoot*  DON  Itospooce 
Distributism 
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«AO  DRAFT  REPORT  -  DATED  MAY  19, 1998 
(GAO  CODE  511624)  OSD  CASE  l«2 

‘DEFENSE  COMPUTER*  YEAR  2000  COMPUTER  PROBLEMS  TOT  ,W 
OPERATIONS  AT  KfSfC* 


RECOMMENDATIONS 


•  fi¥TJAM  VIJIJST> aX^ O^S-l  l  The  GAO  reconnnended  that  die  Secretary  wf  if® 
rfitert  the  Novy  CIO  »*•  ensure*  dud  ihc  Ncvy  Ycur  2000  cnwhmioo  nftuv  tt 
pcovided  with  sutftcteM  staff  wuloodoiniy  to  establish  u  emnpleta  o:d  :iocora>c* 
iovenrovy  of  rfs  information  systems.  Ensure  tlwl  th&  dels  pn/bJcms  iUeirfhVd  in  thitf 
report  are  corrected  avid  routinely  validate  the  information  submitted  h>  computi*; r.w 
M  the  database*.  (p.  29.GAQ  Draft  Report) 

«  DON  RESPONSE;  Concur  -  Tha  DON  Y2K  taKKi  fc*is  been  i upisatfowd  rinas  May 
19%.  Since  that  doit  iht  DON  CiO  Y2R  team  bo?;  grocvji  tolO  toll  Itms  employee*, 
hi  March  W8,  the  Navy  V2K  Project  Offk-t  whs  activated  to  eowdinateNuw  Y2fc 
issLtfs  This  office  is  staffed  by  OPN4V  codes  vritb  13  fail  time  employees  and  led 
Jjv  o  Flag  Ofticor.  TJuk  Mtuicc  Corps  Y2K  Teaio  Lwvdioacs  Atazbie  Ooips  issues 
and  is  staffed  by  6  fu+l  rime  ecrcployttsi,  and  led  I>y  a  Marine  C(«  ps  Coluutj.  The 
Cu  >N  <  10  V2K  Team  crardhrato  both  Navy  a^d  Marine  C  orps  isawy.  The  To  >N 
CIO  has  nlsoftstabiished  veekiy  bootings  by  the  Department  of  Navy  organizations, 
tn  tdoriUy/recijty  pccfclcm*  aod'or  weaknesses. 

Ai  (he  time  of  this  GAO  audit.  the  MON  was  reliant  mi  the  Defense  Integrated 
Support  Tool  (MIST)  a*  its  database  lot  Y2K  management  and  reporting  OorOtr  this 
yr:<  ibe  Oflxe  of  \bo  Sccjctoy  of  Defense  (OSD)  uiaiisiti&d  the  database  :ma  il  vjas 
pulled  from  use,  leaving  the  DON  wih  no  V2K  database.  Wirii  the  classification  trf 
(hr.  DJST.  the  DON  had  to  develop  aa  vtcrnativc  database  loo  1  to  hack  und  document 
the  ricrem  statue  of  Y2K  uoiWty.  Tee  naw  DON  database  will  he.  oo-iiec  io  Juw  93 
VEOe  and  PMs  will  ktve  direct  access  to  the  datable  to  pwv«fc  system*  suh>>$tao, 
intortirc  and  cost  in&nnaiian  itidndhqt  actual,  programmed  and  te-pnorilrz^  costa. 
AU  levels  of  the  Navy.  Marine  Carp?  and  (he  Reserves  wttt  nave  access  to  the  DON 
Y2X  database. 

Weekly  reviews  ol  die  Y2K  database  will  be  conducted  by  ditr  DON  CIO  Y2JC  loooi 
(n*  part  of  the  vatidotioo  preeeas)  for  cr*np  Icterus  and  accuwy. 
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•  RECOMMENDATION  Z:  Tte  GAO  terajornavkit  dw»  tint  Secrecy  of  the  Navy 
dhect  the  Navy  CIO  to  ensure  that  tiiv  Navy  Y&sr  -2000  Own d: iwhon  Otfice  itf 
provided  vilh  sufficient  staff  and  uudinfity  to  unsure  that  components  have  identified 
a:\it  corrected  imetfoces  and  developed  writtOQ  roomomiiditfQs  of  agrewvim  with 
bnerfete  partners,  29/flAO  Draft  Rrpoifi 

•  PON  RKSPONS£:  CoQqqc  r.lhe  DON  CIO  requires  all  pregraro  loaoogow  Cu 
uugrrtTate  rnemorsiKl*  ot  agreement  regarding  system  to  £>,<1icni  tnterfiufes.  Tbfes  is  ar. 
.ingoing  effort  raptiring  cotnfouow  iwtivjty  Interlace  MOA  uvfcraulian  was  never 
bidudod  in  *he  t>c*D  pro  voted  D?ST  <folwMsf.  henee  the  GAO  found  dui  DON  buddog 
in  tbit?  aft**,  hitertkev  MOA  progress  wiij  tw  tjxked  rttd  reported  ioihe  fX>N  YZK 
Hfth»fe«se.  ScnSo*  leva)  ftftnMtPin£nt  ittvo’vunmt  will  ensure  fhat  tfcesftr  date  elements 
ore  populated  properly  in  the  new  DON  o>t*hw. 

Memoranda.  of  agrtticoii  are  be5njs;  derclopbcl  and  tracked  tijv  h deflate  partners.  Tbe 
DON  database  will  capture  the  status  of  MG  As  to  three  categories.*  (1>M0A.?  drafted 
Id i)  ran  signed,  (2)  osdoucrcd  jtnienn  MOA  will  bo  digued,  and  (})  the  actw  dn»e  an 
MCA  whs  sigutd.  Sooi or  ciajtrtgsineui:  end  ibe  fXW  CIO  Jtave  noted  thai  foterfocc 
MOas  with  other  Government  Agencies  wie  mruessaiy  and  ac  being  pursued. 

%  GAO  fucutnownded  that  the  Secrctar*  of  the  Navy 

;lire/:t  die  Nj>vy  CIO  to  ensure  dud  the  Nuvy  Yw  ^000  Coordination  Office  h* 
powcteci  with  sctficicnt  staff  aiul  audvmcy  to  develop  a  ikpartrnerrt-wufc  tading 
strategy  lb#  describes  s>  wno  jtKJoagcobwwr  rides  and  respMddbiliUex* 

*y  rtetii/projuiA  priorities  a master  schedule  of  loch  level  test  utfividw  (people  tool* 
&u\ititie$,  contactor?).  Ensure  that  the  Nnvy  component  develop  theiv  invn  test 
strategies  fetnd  require  ibetr  systeo;  aacnn^cjrymVDPK  to  develop  individual  tasi  pbus. 
(p.  2WO/OAQ  Dmtl  Report) 

*  WON.RfiSPONSEt  fie  Wavy  V  25C  Project  Office  is  loading  an  IPY  to 

develop  a  Y2K  Vtester  Teat  Pkn  that  v-ill  develop  ail  required  element*  identified  fcy 
the  0  AO  roport  loul^s  ibe  pn^r>cd  >ovy  Y2R  Test  Slcarcgy  'here  are  3-IcstJ®  of 
tustir.^:  G;  system  level  tasting  b>  poig>vCit  owners  ♦PliG^FVlAs,  ote.)*  (2>  Ainetvuud 
urging  in  an  oper^fo.ul  ortvhonmejd  to  add*vss  furiedwraS  system  hdegnitnTJi  and,  0) 
hat  tic  tp'onp  miepemed  icsdog  aflou.  In  andnipodoit  of  f  ro'O  policy  on  mtugvated 
testing,  ibe  DOM  ic  prcpowl  to  provide  ccppoo  ^  Join!  Staff  tor  dcvciopiocntcf 

o  UoD  v/idt  test  pfnn.  I  Jie  IKIN'  Y2  K  OirtoPase  t^hs  the  existenv  t?  of  test 
joftawtiw  and  piogiw  during  the  v^idaiion  (festiog)  phase. 

*  RE.COMMRNHATION  4;  }>c  GAO  reconimended  tMr  the  Secretary  of  it  a  No  vy 
daoot  tire  Navy  CS O  to  cjnsoco  thcr  dv  Novy  YwrSWlrt  Coordination  Office  Is 
provided  vhb  sufficteiti  slotlccd  mOhority  to  ensure  tbot  Year^.ftOO  cootingwicv 
planning,  focuses  on  ftiu  conti  nmly  of  AH  ufNsvy ’s  critical  military  opemtiiOta  w;d 
boston  pwc$se.»  rather  thvs  oi>  only  u  wnall  portion  of miessosHsiatical  syrteotx. 

(p,  2!I •^Ort’jAO  Dtnft  Report)  {p.  20*.b'HOAO  Draft  Report) 
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»  1) ON  RESPONSE:  Concur  *  foidingcr-cy  plwis  have  hceP  larniifieii  y$  an 
boporocil  uoaponcot  of lbc  owjutgttneot  pcoce.ss  ar*d  ore  h?:ng  developed  foe 

lotssjon  uilical  systems  and  sonic  misshm support  systems.  Wavy  Y2K  Vroieut 
otf ice  is  hiding  a  ram  to  coordinatorhe  development  of  contingency  plans  to 
peumote  ewdirobty  i*f  haloes*  opccflJlort^  aod  ensure  rollon  capability  at  the  oset 
level  'fl®  Navy  Y2K,  fjojeei  oRu:k  is  cow  reipdrci^coodo^oocy  ptoosfor  ait 
mission  critical  syftetne  no  foier  dom  3  1  Dcccmhei  *  Hiv  Marine  Corps  Y2k 
ufilce  -drady  ntqutras  vwrtittgoavy  phnts  for  all  then  wrfann*  (ir-t^ioo  wttK-tf  -rod 
nriraoa  rapport). 
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Alicia  L.  Sommers,  Senior  Information  Systems  Analyst 


Chicago/Dayton  Field 
Office 
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Robert  G.  Preston,  Senior  Evaluator 


Atlanta  Field  Office 


Christopher  T.  Brannon,  Senior  Evaluator 
Teresa  F.  Tucker,  Senior  Evaluator 
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The  first  ropy  of  each  GAO  report  and  testimony  is  free. 
Additional  copies  are  S2  each.  Orders  should  be  sent  i.o  the 
following  address,  accompanied  by  a  check  or  money  order 
made  out  to  the  Superintendent  of  Documents,  when 
necessary.  VISA  and  MasterCard  credit  cards  are  accepted,  also. 
Orders  for  100  or  more  copies  to  be  mailed  to  a  single  address 
are  discounted  25  percent. 

Orders  by  mail: 

IJ.S.  General  Accounting  Office 
P.0.  Box  37050 
Washington.  DC  20013 

or  visit: 

Koom  1100 

700  4th  St.  NW  (corner  of  4th  and  G  Sts.  NW> 

IJ.S.  General  Accounting  Office 
Washington,  DC 

Orders  may  also  he  placed  by  calling  (202)  512  6000 

or  bv  using  fax  number  (202  )  512  0061.  or  TDD  (202)  512  2537. 

hack  day.  GAO  issues  a  list  of  newly  available  reports  ami 
testimony.  To  receive  facsimile  copies  of  the  daily  list  or  any 
list  from  the  past  30  days,  please  call  (202)  512-6000  using  a 
touch  (one  phone.  A  recorded  menu  will  provide  information  on 
how  to  obtain  these  lists. 

Kor  information  on  how  to  access  GAO  reports  on  the  INTKRNK  T, 
send  an  e-mail  message  vvilh  'info*'  in  the  body  to: 


in  f o  #  vvww.  ga  o .  gov 

or  visit  GAO's  World  Wide  Web  Home  Page  at: 
http  ://www  .gao  .gov 
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